Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20107

General Discussion: Timeline - SIFT kit

$
0
0
badnut wrote: Timelining skills a little rusty - Trying to mount either a compressed E01 (logical image of a C drive) using ewf_mount.py...OR...mount a RAW image (same logical image) using mount command. I tried to run mmls and got 'cannot determine partition type'..any ideas anyone? mmls is run against an image, not a mounted image. When it's mounted, it's a volume. mmls reads the partition table...a logical image is of a volume, and doesn't have a partition table. HTH

Viewing all articles
Browse latest Browse all 20107

Trending Articles